| id |
repos |
scanned |
method |
| scan/minecraft-mods |
| Creators-of-Create/Create (mc1.20.1/dev) |
| AppliedEnergistics/Applied-Energistics-2 (main) |
| mekanism/Mekanism (1.20.x) |
|
2026-03-24 |
WebFetch of key graph/network classes + source review |
Summary
3 major Minecraft mods scanned. 1 confirmed defect (Create). 2 confirmed CLEAN (AE2, Mekanism).
Confirmed defects
| ID |
Mod |
Class |
Pattern |
Severity |
| create-0001 |
Create |
TrackGraph.findDisconnectedGraphs |
ArrayList.remove(0) in BFS frontier loop — O(V²) |
MEDIUM |
Confirmed CLEAN
| Mod |
Class |
Why clean |
| Applied Energistics 2 |
GridNode.java |
BFS uses ArrayDeque; visited tracking uses object-identity integer counter — O(1) |
| Applied Energistics 2 |
PathingService.java |
ignore.contains(node) inside loop uses HashSet — O(1) |
| Mekanism |
TransmitterNetworkRegistry.java |
OrphanPathFinder uses ObjectOpenHashSet<BlockPos> + Deque<BlockPos> — both O(1) |
Notes
- Create defect is
ArrayList.remove(0) (O(n) array shift), not List.contains() —
same CWE-407 class, different manifestation
- Trigger: track removal only, not per-tick — severity bounded by usage pattern
- AE2 and Mekanism both use correct data structures from the start; likely written
with performance awareness given their network-heavy nature
- No community discussion of CWE-407 patterns in Minecraft modding found; performance
discourse focuses on TPS/tick overhead and chunk loading, not graph algorithm
complexity classes
- Minecraft-side DependencySorter.isCyclic (minecraft-0001) affects ALL mods equally
through the tag system; the mod code itself is not at fault for that defect
russell@unturf.com
db29a08762